ship pfblockerbg-devl logs?
-
What is the easiest method to forward all pfblocker logs to my log analyzer? ManageEngine is only receiving logs from syslog but I want to see the top blocked domains in the dnsbl log as well.
-
I only use the alias option in PfblockerNG, but I think it leverages the regular filtering table regardless of the method. As such you should be able to filter on the tracking ID associated with the rule. Make sure your have log box checked on the rule.
And then on the remote syslog configuration page check the Firewall Events box
Since the Alias is of a collection of feeds, that rule would be of all the feeds in the collection. It would be cool to correlate a specific block with a particular feed in an external logging system, but I don't think that is possible.
-
@rtw915
As an example:
https://www.reddit.com/r/pfBlockerNG/comments/bu0ms0/pfblockerngtelegrafinfluxdb_ip_block_list/ -
@bbcan177 said in ship pfblockerbg-devl logs?:
@rtw915
As an example:
https://www.reddit.com/r/pfBlockerNG/comments/bu0ms0/pfblockerngtelegrafinfluxdb_ip_block_list/That is cool! I did not know that was possible. I saw in your Reddit post that you stated "pfSense doesn't have a lot of graphing/logging functionality." I 100% agree with you that it should not be part of the firewall, but it would be awesome to have a Netgate preferred solution like Graylog with a step by step guide to integrate the logging from the firewall and its common packages into a centralized visualization platform.
